0

I've installed Debian stable 9.3 server for an Nginx environment, and I consider upgrading it daily via cron:

0 0 * * * apt-get update -y && apt-get upgrade -y

My system is minimal and uncustomized: It's a VPS to run a webserver with only these ports open: 22, 80, 443, 9000.

My system has no third-party software (that is, software originating outside the Debian repositoirs), besides CSF-LFD, Maldet and WP-CLI.


Is it still problematic to upgrade daily as I plan to do? Given I host at DigitalOcean I've asked the DigitalOcean support about this and they said it should be okay but added something like "there has been some webservers that stopped working due to such upgrades" (it isn't clear if the aforementioned webservers and their environments where of a similar, let alone identical, stack and if they even were Debian stable).

Do you also see a problem in the daily upgrade approach I take to my specific minimalist stack?

I assume I don't want to use unattended-upgrades that gives only security upgrades. I want to make sure everything is upgraded. This was my main reason to move from Ubuntu 16.04 xenial to Debian stable.

I guess this answer can indeed have an answer like "generally it is a wrong approach considering your current stack" or "generally it isn't wrong considering your current stack".

closed as primarily opinion-based by muru, Rui F Ribeiro, Jeff Schaller, jimmij, Timothy Martin Jan 10 '18 at 2:40

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    You can configure unattended-upgrades to apply all updates, not just security updates... – Stephen Kitt Jan 9 '18 at 8:10
  • Is it different, significantly the cron command I listed above? – Arcticooling Jan 9 '18 at 8:12
  • 1
    Yes, it includes a whole lot of checks and edge cases for when a blanket "Just toss it in and don't worry about consequences" might not be wise. – Shadur Jan 9 '18 at 8:47
3

I think your premise is flawed — unattended-upgrades can be configured to apply any update, not just security updates. It also takes care of quite a bit more than just apt-get update && apt-get upgrade: it will avoid starting upgrades which require interaction (e.g. for configuration changes), it can be given a list of packages not to upgrade, it can handle incomplete dpkg runs, it can send email in a variety of circumstances (cron will do that too), it can reboot automatically if necessary (which is useful following a kernel upgrade), etc.

See its documentation for details.

Not the answer you're looking for? Browse other questions tagged or ask your own question.